CVE-2023-35116

jackson-databind through 2.15.2 allows attackers to cause a denial of service or other unspecified impact via a crafted object that uses cyclic dependencies. NOTE: the vendor's perspective is that this is not a valid vulnerability report, because the steps of constructing a cyclic data structure...

PT-2023-25167 · Digital.Ai +1 · Jenkins Digital.Ai App Management Publisher Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Digital.ai App Management Publisher Plugin versions 2.6 and earlier Description: A cross-site request forgery CSRF vulnerability allows attackers to connect to an attacker-specified URL, capturing credentials stored in Jenkins. The...

Jenkins 跨站请求伪造漏洞

Jenkins is a Jenkins open source application . An open source automation server Jenkins provides hundreds of plugins to support building, deploying and automating any project. A security vulnerability exists in Jenkins version 2.399 and earlier, LTS version 2.387.3 and earlier. An attacker...

CVE-2023-27836

TP-Link TL-WPA8630P US V2 Version 171011 was discovered to contain a command injection vulnerability via the devicePwd parameter in the function sub 40A80C...

SUSE CVE-2023-3192

Session Fixation in GitHub repository froxlor/froxlor prior to 2.1.0...

PT-2023-3769 · Siemens · Sicam Q200 +1

Name of the Vulnerable Software and Affected Versions: POWER METER SICAM Q100 versions prior to V2.60 Siemens SICAM Q200 affected versions not specified Description: A vulnerability has been identified where affected devices are missing cookie protection flags when using the default settings. Thi...

TP-Link TL-WPA8630P 命令注入漏洞

The TP-LINK TL-WPA8630P is a WIFI extender from China P&L TP-LINK. A security vulnerability exists in the TP-Link TL-WPA8630P USV2171011 version, which stems from the discovery of the inclusion of a command injection vulnerability via the parameter key...

PT-2023-3377 · Siemens · Power Meter Sicam Q200 +1

Name of the Vulnerable Software and Affected Versions: POWER METER SICAM Q100 versions prior to V2.60 POWER METER SICAM Q200 affected versions not specified Description: A vulnerability has been identified in the web interface of the affected devices, making them vulnerable to Cross-Site Request...

WordPress Plugin Kevon Adonis WP Abstracts 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting...

D-Link DIR-600 缓冲区错误漏洞

The D-Link DIR-600 is a wireless router from China's AUO D-Link. A buffer overflow vulnerability exists in the D-Link DIR-600 version 2.18, which originates from a boundary error in the file gena.cgi when processing untrusted input, and can be exploited by an attacker to execute arbitrary code on...

TP-LINK EC-70 缓冲区错误漏洞

The TP-LINK EC-70 is a camera from China P&L TP-LINK. A security vulnerability exists in TP-LINK EC-70 version 2.3.4 and earlier, which stems from the presence of a buffer overflow vulnerability...

CVE-2023-1430

The FluentCRM - Marketing Automation For WordPress plugin for WordPress is vulnerable to unauthorized modification of data in versions up to, and including, 2.7.40 due to the use of an MD5 hash without a salt to control subscriptions. This makes it possible for unauthenticated attackers to...

CVE-2023-1169

The OoohBoi Steroids for Elementor plugin for WordPress is vulnerable to missing authorization due to a missing capability check on the 'fileuploadercallback' function in versions up to, and including, 2.1.4. This makes it possible for subscriber-level attackers to upload image attachments to the...

Urbandroid Sleep 安全漏洞

Urbandroid Sleep is an app from Urbandroid Inc. which is used to track the sleep of customers. A security vulnerability exists in Urbandroid Sleep version v.20230303 that originates from an unauthorized application causing a persistent denial of service by manipulating the SharedPreference file...

CVE-2023-3142

Cross-site Scripting XSS - Stored in GitHub repository microweber/microweber prior to 2.0...

CVE-2021-4348

The Ultimate GDPR & CCPA plugin for WordPress is vulnerable to unauthenticated settings import and export via the exportsettings & importsettings functions in versions up to, and including, 2.4. This makes it possible for unauthenticated attackers to change plugin settings and conduct attacks suc...

CVE-2019-25149

The Gallery Images Ape plugin for WordPress is vulnerable to Arbitrary Plugin Deactivation in versions up to, and including, 2.0.6. This allows authenticated attackers with any capability level to deactivate any plugin on the site, including plugins necessary to site functionality or security...

PT-2023-12457 · WordPress · The Ultimate Gdpr & Ccpa

Name of the Vulnerable Software and Affected Versions: The Ultimate GDPR & CCPA plugin for WordPress versions up to, and including, 2.4 Description: The issue allows unauthenticated attackers to import and export settings via the export settings and import settings functions. This enables them to...

CVE-2023-0985

An Authorization Bypass vulnerability was found in MB Connect Lines mbCONNECT24, mymbCONNECT24 and Helmholz' myREX24 and myREX24.virtual version = 2.13.3. An authenticated remote user with low privileges can change the password of any user in the same account. This allows to take over the admin...

Percona Monitoring and Management 路径遍历漏洞

Percona Monitoring and Management is an open-source database monitoring solution from Percona, USA. A security vulnerability exists in Percona Monitoring and Management server version 2.x prior to 2.37.1, which stems from the authentication function in authserver.go that does not properly formali...